好的博客

http://rdc.gleasy.com/

https://www.netiq.com/documentation/sentinel70/s701_user/data/btgm07l.html

http://www.tibco.com/products/event-processing

 

State correlation rules

Correlation is achieved with state-based and stateless rules. You specify these rules by using XML syntax, defined by the supplied DTD file, tecsce.dtd. The location of the default XML file is $BINDIR/TME/TEC/default_sm/tecroot.xml. Sample XML rule files are provided in the /EIFSDK/samples/state_correlation directory on the IBM Tivoli Enterprise Console Non-TME Installations CD.

Most rules are defined using state machines. A state machine gathers and summarizes information about a particular set of related events. It is composed of states, transitions, summaries, and other characteristics, such as expiration timers and control flags.

There are five state-based rule types: duplicate, threshold, passthrough, resetOnMatch, and collector, all based on state machines. Each state machine looks for a trigger event to start it. There is one stateless rule type: match.

A state-based rule operates on a sequence of events arriving at the state correlation engine, whereas a stateless rule operates on a single, current event. A rule can contain the following elements:

• Predicates for matching events relevant to that rule
• Actions that run after the rule triggers
• Attributes, such as a threshold limit

There are six rule types: duplicate, match, collector, threshold, passthrough, or resetOnMatch. Each rule analyzes incoming events based on predicates you specify; depending on this analysis, each received event is either discarded by the rule or forwarded to the actions specified in the rule. (If no action is specified, the events are forwarded to the gateway.)

Duplicate

The first event is forwarded, and all duplicate events are discarded.

Match

All the events that match the rule are forwarded.

Collector

Events are collected for the time specified in the rule and then all events are sent individually to the server.

Threshold

A single event is sent to the server when the threshold is reached.

Passthrough

The events are sent to the server only if a specific set of subsequent events arrives during a time window.

Reset On Match

The events are sent to the server only if a specific set of subsequent events does not arrive during a time window.

Note:

An event is analyzed according to the time it arrives at the state correlation engine, not the time it originates. In some circumstances, this can affect the behavior of time-based rules, such as thresholding rules. For example, if the connection between an event source and the gateway is lost, events are cached at the adapter until the connection becomes available again. When the connection is restored, all of the cached events are sent at once, which might trigger a threshold rule unexpectedly.